Django Vue Admin

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:24 AM UTC
• Version: 1.0.0

Overview

This code-generation skill is not deceptive, but its generated admin/security code contains unsafe authorization and default-password patterns that need review before use.

Use this only in a disposable branch or sandbox. Before merging generated code, fix the object-permission return path, remove the 0000 default password, validate module names and output paths, avoid automatic overwrites, pin the upstream project and dependencies, and run security-focused tests for authentication, authorization, and destructive CRUD actions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: templates/CORE_MODULES.md:257

Finding

Object-Level Authorization Result Is Discarded

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: templates/CORE_MODULES.md:486

Finding

New Accounts Receive a Predictable Default Password

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/generator.py:281

Finding

Unsanitized Module Name Enables Output Path Traversal and File Overwrite

Content

View full analysis

2 else "myapp" ``` It is later embedded in the output path without validation or a containment check: ```python client_dir = os.path.dirname(os.path.dirname(os.path.dirname(models_path))) api_path = os.path.join(client_dir, 'src', 'api', f'{module_name}.js') if not os.path.exists(os.path.dirname(api_path)): os.makedirs(os.path.dirname(api_path)) api_content = generate_api_js(models, module_name) with open(api_path, 'w', encoding='utf-8') as f: f.write(api_content) print(f"生成: {api_path}") ``` ### Technical Analysis `module_name` is treated as both a logical identifier and a filesystem path component. Values containing path separators and parent-directory components, such as `../`, are accepted. `os.path.join()` does not prevent traversal, and the resulting path is neither canonicalized nor checked to ensure it remains under `src/api`. The generator opens the destination using write mode, so an existing reachable `.js` file is truncated and replaced. It may also create unintended intermediate directories. The input model path similarly controls the derived project location, but the confirmed traversal primitive is the unsanitized `module_name` embedded in `api_path`. ### Attack Path 1. An attacker persuades a developer or automation process to run the generator with an attacker-controlled module name. 2. The supplied value contains traversal components, for example `../../target`. 3. `os.path.join()` constructs a path that escapes the intended `src/api` directory. 4. `os.makedirs()` creates unintended directories if necessary. 5. `open(..., 'w')` creates or overwrites the escaped destination. 6. Generated J ...[truncated 512 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:371

Finding

Setup Instructions Install Code from Mutable and Unverified Third-Party Sources

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

| `templates/LOGIC_FLOW.md` | 流程逻辑（登录/权限校验/数据权限） |

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/BUSINESS_LOGIC.md (reported line 401)May include surrounding context.

6.6 前端权限控制

vue

<!-- 1. 菜单权限 (路由守卫) -->
<el-menu>
  <el-menu-item v-if="hasPermission('user')">用户管理</el-menu-item>
</el-menu>

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The object-level permission hook calls has_obj_perm(request.user, obj) but ignores its return value and then unconditionally returns True. As a result, any authenticated user can access objects that should be blocked by department or data-scope restrictions, defeating the intended row-level authorization checks.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · templates/CORE_MODULES.md (reported line 735)May include surrounding context.

md

| | POST /api/system/user/ | user_create | 创建用户 |
| | GET /api/system/user/{id}/ | * | 用户详情 |
| | PUT /api/system/user/{id}/ | user_update | 更新用户 |
| | DELETE /api/system/user/{id}/ | user_delete | 删除用户 |
| | GET /api/system/user/info/ | - | 当前用户信息 |
| | PUT /api/system/user/password/ | - | 修改密码 |
| 角色 | GET /api/system/role/ | * | 角色列表 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly tells users they can directly copy generated code into their project, but it provides no warning to review the code, validate security controls, or avoid overwriting existing files. In a code-generation skill that emits backend routes, serializers, models, and frontend code, this can lead to unsafe or integrity-impacting changes being introduced into production codebases without scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow presents generated backend and frontend files as ready to drop into specific project paths, culminating in direct use by the user, without any caution about destructive edits, overwriting application files, or introducing insecure patterns. Because the skill generates full-stack CRUD code that touches models, views, URLs, and client logic, the lack of review guidance increases the risk of accidental integrity loss and deployment of insecure code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains skill instructions and descriptions exclusively in Chinese, including headings, comments, and API documentation. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The signal claims to refresh permission caches when roles change, but it only listens to User.roles membership changes and only for post_add/post_remove. Changes to a Role's permissions, or cache staleness after other relevant updates, can leave users with outdated authorization data, causing privilege retention or incorrect denials until cache expiry.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The table describes /api/token/black/ as GET for logout while stating it adds the token to a blacklist. A GET request is conventionally read-only, and token blacklisting is a server-side state change that normally requires a POST with the refresh token payload; the documentation therefore contradicts the actual semantics of the operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file is titled entirely in Chinese and presents all instructional content in Chinese without indicating that language selection is optional. Under the policy rule for language or locale constraints, this can be treated as a natural-language policy issue because users are not offered an explicit opt-in or alternative locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown template consistently prescribes Chinese field names, comments, verbose_name values, and UI labels such as '名称', '产品', and '订单'. Under the policy, forcing a specific language without user opt-in is a natural-language locale constraint and should be documented as optional or region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file is written as a skill template and its title immediately establishes Chinese-only output/usage context. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation because no alternative language option or justification is provided anywhere in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The inline comment 所有人可访问 (需登录) is internally contradictory because 'everyone can access' is not true if authentication is still required. The surrounding configuration shows global IsAuthenticated enforcement, so the real behavior is 'any authenticated user' rather than literally everyone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The natural-language strings in the template docstring are written only in Chinese ("模块 URL 路由模板" and "自动生成时间"), which indicates a fixed language choice in generated output. For a general backend template, this can violate language/locale policy when no user opt-in or region-specific justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code template includes natural-language strings exclusively in Chinese, such as the module docstring and generated-time label. Under the policy for language/locale constraints, this can constitute a forced language choice when the skill does not offer any user opt-in or locale selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The module-level documentation states this is a code generator that automatically generates '完整 CRUD 代码' from models. In implementation, the script writes serializers.py, views.py, urls.py, and a frontend API JS file, but does not generate templates/views/components that would ordinarily make the CRUD output 'complete'. This is an intent/documentation overclaim rather than a security-relevant capability expansion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring is entirely in Chinese and presents the skill as a Chinese-language code generator, with no indication that other languages are supported or that the locale is region-specific by design. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.